Debian Rails vulnerabilities

CVE-2026-33195 [HIGH] CVE-2026-33195: rails - Active Storage allows users to attach cloud and local files in Rails application... Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing

CVE-2026-33173 [MEDIUM] CVE-2026-33173: rails - Active Storage allows users to attach cloud and local files in Rails application... Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags t

CVE-2026-33170 [MEDIUM] CVE-2026-33170: rails - Active Support is a toolkit of support libraries and Ruby core extensions extrac... Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result

CVE-2026-33169 [MEDIUM] CVE-2026-33169: rails - Active Support is a toolkit of support libraries and Ruby core extensions extrac... Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time c

CVE-2026-33202 [MEDIUM] CVE-2026-33202: rails - Active Storage allows users to attach cloud and local files in Rails application... Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be p

CVE-2026-33176 [MEDIUM] CVE-2026-33176: rails - Active Support is a toolkit of support libraries and Ruby core extensions extrac... Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation

CVE-2026-33174 [MEDIUM] CVE-2026-33174: rails - Active Storage allows users to attach cloud and local files in Rails application... Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause th

CVE-2026-33168 [LOW] CVE-2026-33168: rails - Action View provides conventions and helpers for building web pages with the Rai... Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a

CVE-2026-33167 [LOW] CVE-2026-33167: rails - Action Pack is a Rubygem for building web applications on the Rails framework. I... Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabl

CVE-2026-33658 [LOW] CVE-2026-33658: rails - Active Storage allows users to attach cloud and local files in Rails application... Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resultin

CVE-2025-24293 [CRITICAL] CVE-2025-24293: rails - # Active Storage allowed transformation methods potentially unsafe Active Sto... # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrar

CVE-2025-55193 [LOW] CVE-2025-55193: rails - Active Record connects classes to relational database tables. Prior to versions ... Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1. Scope: local bookworm: resolved (fixed

CVE-2024-26144 [MEDIUM] CVE-2024-26144: rails - Rails is a web-application framework. Starting with version 5.2.0, there is a po... Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The v

CVE-2024-47889 [MEDIUM] CVE-2024-47889: rails - Action Mailer is a framework for designing email service layers. Starting in ver... Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnera

CVE-2024-47888 [MEDIUM] CVE-2024-47888: rails - Action Text brings rich text content and editing to Rails. Starting in version 6... Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the `plain_text_for_blockquote_node helper` in Action Text. Carefully crafted text can cause the `plain_text_for_blockquote_node` helper to take an unexpected amount of time, pos

CVE-2024-41128 [MEDIUM] CVE-2024-41128: rails - Action Pack is a framework for handling and responding to web requests. Starting... Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of tim

CVE-2024-47887 [MEDIUM] CVE-2024-47887: rails - Action Pack is a framework for handling and responding to web requests. Starting... Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully

CVE-2024-28103 [MEDIUM] CVE-2024-28103: rails - Action Pack is a framework for handling and responding to web requests. Since 6.... Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3. Scope: local bookworm: resolved (fixed in 2:6.1.7.10+dfsg-1~deb12u1) bullseye: resolved forky: resolved (fixed

CVE-2024-26143 [MEDIUM] CVE-2024-26143: rails - Rails is a web-application framework. There is a possible XSS vulnerability when... Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vul

CVE-2024-54133 [LOW] CVE-2024-54133: rails - Action Pack is a framework for handling and responding to web requests. There is... Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user in